Whistleblower Chelsea Manning was released from prison more than a year ago, after former President Barack Obama commuted her sentence for releasing military and diplomatic records to WikiLeaks. But her case still continues, as Manning wants to appeal her original conviction—including one charge under a controversial a federal anti-hacking law.
The Computer Fraud and Abuse Act (CFAA) is intended to punish people for breaking into computer systems. Yet Manning didn’t break into anything. Instead, she was found guilty of violating the CFAA for using a common software utility called Wget to access a State Department database—a database she was generally authorized to access—in violation of a computer use policy. The policy prohibited the use of unauthorized software, even though the prohibition, which covers everything from computer games to simple automated Web browsing tools like Wget, is rarely enforce by the chain of command. Prosecutors have argued that Manning’s use of the Wget software violates the law’s provision again intentionally exceeding “authorized access” to a computer connected to the Internet.
But as EFF and the National Association of Criminal Defense Lawyers (NACDL) argued in an amicus brief filed last week in Manning’s request for a hearing on appeal, violating an employer’s policy on computer use is not a crime under the CFAA. If it were, then it would turn scores of people into criminals for things like browsing Facebook or viewing online sports scores at work. It would also threaten the work of researchers and journalists, who increasingly rely on common automated Web browsing tools to more efficiently access publicly available information on the Internet so that they can do their work, even though such tools are often prohibited in websites’ terms of service. Overzealous prosecutors and private companies have long taken advantage of the CFAA’s vague language to threaten criminal charges that go beyond Congress’s original goal to police computer crime, and Manning is only one of the latest high-profile victims.
We can’t have ordinary online behavior—such as the use of simple, common tools for making it easier to collect publicly available information—become a federal criminal offense. Four other circuit courts have agreed. We hope the United States Court of Appeals for the Armed Forces takes Manning’s case and helps bring some fairness to the CFAA.
